ea4def4a0b1854aed9b8b302223eb08cac60c9d02720b527ea5a4ba840e70b43

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 06:05

Target

5abebe2f05417576efdb1dc1f0549ded_JaffaCakes118.exe
Size

11KB
MD5

5abebe2f05417576efdb1dc1f0549ded
SHA1

e7e57d9f60000568ac3906149b1693ad91d04873
SHA256

ea4def4a0b1854aed9b8b302223eb08cac60c9d02720b527ea5a4ba840e70b43
SHA512

6ebb5ff71da4c724e78d8e3dd753a38f77b3286f6009b18bcce485c62bf0283f96686d97d4f62c3206a82a183a5c61ad1e1418e709d521c726a71365452edc7b
SSDEEP

192:2kEWFFQvZaFVbkQRfTHA4cVCnlYJL9XKgxSdLTCxqeXfJqnAM:27ZaFJk+AHhpX/xkLTCwyfJ7M

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2736	2684	5abebe2f05417576efdb1dc1f0549ded_JaffaCakes118.exe	30
PID 2684 wrote to memory of 2736	2684	5abebe2f05417576efdb1dc1f0549ded_JaffaCakes118.exe	30
PID 2684 wrote to memory of 2736	2684	5abebe2f05417576efdb1dc1f0549ded_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5abebe2f05417576efdb1dc1f0549ded_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5abebe2f05417576efdb1dc1f0549ded_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 884
  2⤵
  PID:2736

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2684-0-0x000007FEF5CDE000-0x000007FEF5CDF000-memory.dmp

Filesize
4KB

Download
memory/2684-1-0x000007FEF5A20000-0x000007FEF63BD000-memory.dmp

Filesize
9.6MB

Download
memory/2684-6-0x000007FEF5A20000-0x000007FEF63BD000-memory.dmp

Filesize
9.6MB

Download
memory/2736-5-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/2736-7-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download